Encrypting Your Cat Photos

The truth is, I really don't have anything on my hard drive that I would
be upset over someone seeing. I have some cat photos. I have a few text
files with ideas for future books and/or short stories, and a couple
half-written starts to NaNoWriMo novels. It would be easy to say that
there's no point encrypting my hard drive, because I have nothing to
hide. The problem is, we wrongly correlate a "desire for
privacy" with
"having something to hide". I think where I live, in America, we've taken
our rights to privacy for granted. Rather than the traditional "he must
be hiding porn or bombs", think about something a little more
mundane.

I live in Michigan. It's cold here in the winter, and I tend to keep my
thermostat set around 75 degrees. That might seem high to you, but for my
family, it's just right. Thanks to the privacy of my own home, my neighbors
don't know how toasty warm we keep it. Some of those neighbors would be
very upset to see how "wasteful" the Powers family is in the winter. In
fact, there's one local man who makes it a point to let everyone know
that anything over 60 degrees is ecologically wasteful. I don't want to get
into a fight with Old Man Icebritches, so we just keep our comfortable
house a secret. We don't have anything to hide, but it's not something
everyone needs to know about.

Obviously my example is silly, but hopefully it makes you think. Modern
Linux allows us to encrypt our data easily and reliably, so why not take
advantage of it?

How Does It Work?

I won't go into too much detail about how encryption works, but a basic
understanding is necessary for even the simplest implementation. To
encrypt and decrypt a file, two "keys" are required. One is the
private key, which is just that, private. I like to think of the private
key as an actual key—you can make copies if you want, but it's not
wise to do so. The more copies of your private keys you make, the more
likely someone nefarious will get one and break into your apartment—er,
I mean files.

The public key is more like a schematic for a lock that only you can open
(with your private key). You make this key available for anyone. You
can post it on a Web site, put it in your e-mail, tattoo it on your back,
whatever. When others want to create a file that only you can see,
they encrypt it using your public key.

This one-to-many scenario also has a cool side effect. If you encrypt
something using your private key, anyone can decrypt it using your
public key. This may sound silly, but what makes such a scenario useful
is that although the encrypted file isn't protected from prying eyes, it is
guaranteed to be from you. Only a file encrypted with your private key
can be decrypted with your public key. In this way, encrypting something
with your private key digitally "signs" the file.

Usually it works like this:

You have a file you want to send to Suzy, so you encrypt it with
Suzy's public key. Only Suzy can open it, but there's no way for Suzy
to know that you are the one who sent it, since anyone could encrypt a
file with her public key.

Therefore, you take the file you encrypted with Suzy's public key
and encrypt that file with your private key. Suzy will have to decrypt
the file twice, but she'll know it came from you.

Suzy receives the file and decrypts the first layer with your public
key, proving it came from you.

Suzy then decrypts the second layer of encryption with her private key,
as that's the only key able to decrypt the original file. (Because
you originally encrypted it with her public key.)

That scenario is when encryption is used for safely transferring
files, of course. It's also quite common simply to encrypt your files
(or partitions) so that no one can see them unless you decrypt them
first. Let's start with file encryption, because that's what most people
will want to do on their systems.

Starting Simple

Before I go into more complex type setting, let's discuss simply
encrypting a file. There are various programs to handle encryption.
In fact, it's easy to get overwhelmed with the available options for
file and system encryption. Today, let's use a basic (but very powerful)
command-line tool for encrypting a file. GPG (Gnu Privacy Guard) is an
open-source implementation of PGP (Pretty Good Protection). It allows
encryption and signing, and manages multiple keys and so on. For this
example, let's simply encrypt a file.

Let's say you have a file called secret_manifesto.txt, which contains the
secrets to life, the universe and everything. Using GPG, you can encrypt
the file with a passphrase. Using a passphrase is far simpler than using
a public and private key pair, because it's simply encrypted using your
passphrase. This does make your file more susceptible to cracking (using
rainbow tables or other hacking tools), but like the label on the tin
says, it's Pretty Good Protection. To encrypt your file, you can do this:

Once complete, you'll have a new file in the same directory.
It will be named secret_manifesto.txt.gpg by default. This is a binary file, which
means it's fairly small, but it can't be copy/pasted into an e-mail
or IM. For portability, you can add the -a flag, which will create an
encrypted file that contains only ASCII text:

Notice there is now a file with .asc as the extension. This is text-only,
but you can see in the code snippet that it's also much larger than
the binary encrypted file, and much much larger than the original text
file. Once you've encrypted your file, if you truly want to keep your
information secret, it would be wise to delete the original text file.

To decrypt the file, you'll again use the gpg program. The same command
will decrypt either file, whether it's binary or ASCII:

Notice in the example above, I hadn't deleted the original text file,
so gpg gave me the option of overwriting. Once complete, I have my
original file back, unencrypted. If you just have a file or two you
want to protect, the command-line gpg program might be all you need. If
you'd rather have an area on your system that automatically encrypts
everything you save, it's a little more complicated. It's still not
terribly difficult, but let's start with a fairly simplistic model.